Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We X-Rayed a Suspicious FTDI USB Cable

eclypsium.com

Post reply on HN
Print view View original

11–20 of 88 posts

Re: We X-Rayed a Suspicious FTDI USB Cable

#11

Post by mschuster91 »

invokestatic wrote: post #2

I have a slow burn project where I simulate a supply chain attack on my own motherboard. You can source (now relatively old) Intel PCH chips off Aliexpress that are “unfused” and lack certain security features like Boot Guard (simplified explanation). I bought one of these chips and I intend to desolder the factory one on my motherboard and replace it with the Aliexpress one. This requires somewhat difficult BGA refl…

> I want to make a persistent implant/malware that survives OS reinstalls.

You want to look into something called "Windows Platform Binary Table" [1]. Figure out a way to reflash the BIOS or the UEFI firmware for your target device ad-hoc and there you have your implant.

[1] https://news.ycombinator.com/item?id=19800807

Re: We X-Rayed a Suspicious FTDI USB Cable

#12

Post by mschuster91 »

gregsadetsky wrote: post #4

Yeah - these [0] kinds of cables are so extremely scary. "The O.MG Cable is a hand made USB cable with an advanced implant hidden inside. It is designed to allow your Red Team to emulate attack scenarios of sophisticated adversaries" "Easy WiFi Control" (!!!!!) "SOC2 certification"? Dawg, the call is coming from inside the house... [0] https://shop.hak5.org/products/omg-cable

> "SOC2 certification"? Dawg, the call is coming from inside the house...

Helps corporate red teams in environments where the purchase department is... a bunch of loons.

Re: We X-Rayed a Suspicious FTDI USB Cable

#13

Post by ronsor »

mschuster91 wrote: post #11
invokestatic wrote: post #2

I have a slow burn project where I simulate a supply chain attack on my own motherboard. You can source (now relatively old) Intel PCH chips off Aliexpress that are “unfused” and lack certain security features like Boot Guard (simplified explanation). I bought one of these chips and I intend to desolder the factory one on my motherboard and replace it with the Aliexpress one. This requires somewhat difficult BGA refl…

> I want to make a persistent implant/malware that survives OS reinstalls. You want to look into something called "Windows Platform Binary Table" [1]. Figure out a way to reflash the BIOS or the UEFI firmware for your target device ad-hoc and there you have your implant. [1] https://news.ycombinator.com/item?id=19800807

Only works if the target is running Windows (paranoid people might be on Linux), so you'd probably want to slip in a malicious UEFI driver directly. Tools like UEFITool can be used to analyze and modify the filesystem of a UEFI firmware image.

Re: We X-Rayed a Suspicious FTDI USB Cable

#14

Post by mjevans »

Neywiny wrote: post #7
trinsic2 wrote: post #6

Jeese. I was not sure which image was the suspect one.

If you've read the docs, which I'm not saying anyone is expected to, FTDI tends to put buffers on their outputs. That's what gave it away for me. The little sot-23-5 footprints.

I got it backwards because I expected the counterfeit part to use a newer process IC (less silicon area) than a possibly more reliable and perfectly suitable for serial connection speeds 'vintage' process on some long stable spin of silicon.

Why allow for newer processes on the counterfeit? They'd implement it using the least expensive, most mass produced chips possible, which are more likely to be cut from wafers hitting the sweet spot of size / feature and price crossover.

Re: We X-Rayed a Suspicious FTDI USB Cable

#17

Post by cbsks »

invokestatic wrote: post #8
Nextgrid wrote: post #3

Earlier quoted context omitted.

> persistent implant/malware that survives OS reinstalls Try attacking NIC, server BMC or SSD firmware. You will achieve your goal without any hardware replacement needed.

Yeah, but that doesn’t give me a reason to use the hot air station and hot plate collecting dust on my desk ;)

Nothing drives more creativity from me than a tool in need of a project.

Re: We X-Rayed a Suspicious FTDI USB Cable

#20

Post by da_chicken »

invokestatic wrote: post #8
Nextgrid wrote: post #3

Earlier quoted context omitted.

> persistent implant/malware that survives OS reinstalls Try attacking NIC, server BMC or SSD firmware. You will achieve your goal without any hardware replacement needed.

Yeah, but that doesn’t give me a reason to use the hot air station and hot plate collecting dust on my desk ;)

I mean, you could also do smartphone repairs.
Post reply on HN